npmjs-hitscan

This npm package contains intentionally suspicious code patterns designed to trigger various security scanner heuristics. It is created specifically for testing the effectiveness of npm security scanners, validating static analysis tools, training security professionals, and research purposes in malware detection.

It is designed solely to be analyzed by security scanning tools and heuristic detection systems. The package contains benign simulation code that mimics patterns commonly found in malicious packages, including crypto and obfuscation patterns, network and data exfiltration simulation, filesystem operation patterns, process and system patterns, and package-level suspicious indicators.

The package includes multiple files with various security testing patterns: crypto and obfuscation patterns with Base64/Hex encoding, hardcoded encryption keys, and multiple encoding layers; network and exfiltration patterns with references to suspicious domains, C2 server communication patterns, and port scanning simulation; filesystem patterns including path traversal attempts, sensitive file enumeration, and credential harvesting patterns; and process and system patterns with suspicious command execution, process injection simulation, and privilege escalation attempts.

All functions are benign simulations only. No actual malicious code execution occurs, no network requests are made, no files are actually accessed without permission, no processes are spawned, and no data is actually stolen. All operations are logged but not performed.

Important Note on AI Analysis: Due to the explicit comments and descriptive function and variable naming throughout the codebase, this package is not suitable in its current form for AI-based analysis or training. The suspicious patterns are clearly labeled and documented, making them easily identifiable to AI systems that can read and understand the contextual comments.

When tested with security scanners, you should expect detection of suspicious function names, hardcoded encryption keys and secrets, Base64/Hex encoded suspicious strings, references to malicious domains and IPs, path traversal patterns, process injection patterns, suspicious install/lifecycle scripts, malicious-looking dependency names, obfuscated code execution, and environment variable harvesting patterns.

This package is provided as-is for security testing purposes only.

veryserious.systems